mlsanityData to 7 Oct 2026

Practical Relative Order Attack in Deep Ranking

arXiv 2103.05248 ↗First posted 9 Mar 2021cs.LG cs.CV cs.IRcited by 9

Not on the map. Why?

Abstract (arXiv)

Recent studies unveil the vulnerabilities of deep ranking models, where an imperceptible perturbation can trigger dramatic changes in the ranking result. While previous attempts focus on manipulating absolute ranks of certain candidates, the possibility of adjusting their relative order remains under-explored. In this paper, we formulate a new adversarial attack against deep ranking systems, i.e., the Order Attack, which covertly alters the relative order among a selected set of candidates according to an attacker-specified permutation, with limited interference to other unrelated candidates. Specifically, it is formulated as a triplet-style loss imposing an inequality chain reflecting the specified permutation. However, direct optimization of such white-box objective is infeasible in a real-world attack scenario due to various black-box limitations. To cope with them, we propose a Short-range Ranking Correlation metric as a surrogate objective for black-box Order Attack to approximate the white-box method. The Order Attack is evaluated on the Fashion-MNIST and Stanford-Online-Products datasets under both white-box and black-box threat models. The black-box attack is also successfully implemented on a major e-commerce platform. Comprehensive experimental evaluations demonstrate the effectiveness of the proposed methods, revealing a new type of ranking model vulnerability.

Key facts. Cited by 9 papers in the map (data through 7 Oct 2026). Builds on 39 of its 60 references that are in the map. First posted on arXiv 9 Mar 2021.

Builds on

39 of 60 references.

References · 39

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  4. 2013Intriguing properties of neural networkscited by 5,114
  5. 2017Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithmscited by 4,283
  6. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  7. 2015FaceNet: A Unified Embedding for Face Recognition and Clusteringcited by 2,833
  8. 2016Adversarial examples in the physical worldcited by 1,762
  9. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  10. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  11. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  12. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
27 more
  1. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  2. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  3. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  4. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
  5. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
  6. 2015Deep Metric Learning via Lifted Structured Feature Embeddingcited by 449
  7. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  8. 2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
  9. 2014Learning Fine-grained Image Similarity with Deep Rankingcited by 189
  10. 2019Efficient Decision-based Black-box Adversarial Attacks on Face Recognitioncited by 173
  11. 2018Query-Efficient Hard-label Black-box Attack:An Optimization-based Approachcited by 130
  12. 2020QEBA: Query-Efficient Boundary-Based Blackbox Attackcited by 103
  13. 2020Revisiting Training Strategies and Generalization Performance in Deep Metric Learningcited by 99
  14. 2019NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networkscited by 94
  15. 2020Transferable, Controllable, and Inconspicuous Adversarial Attacks on Person Re-identification With Deep Mis-Rankingcited by 42
  16. 2019Deep Metric Learning Beyond Binary Supervisioncited by 36
  17. 2018Universal Perturbation Attack Against Image Retrievalcited by 31
  18. 2019Targeted Mismatch Adversarial Attack: Query with a Flower to Retrieve the Towercited by 26
  19. 2021QAIR: Practical Query-efficient Black-Box Attacks for Image Retrievalcited by 22
  20. 2018Ranking Robustness Under Adversarial Document Manipulationscited by 15
  21. 2019Ladder Loss for Coherent Visual-Semantic Embeddingcited by 15
  22. 2020Adversarial Ranking Attack and Defensecited by 14
  23. 2020Adversarial Attack on Deep Product Quantization Network for Image Retrievalcited by 13
  24. 2019Who's Afraid of Adversarial Queries? The Impact of Image Modifications on Content-based Image Retrievalcited by 10
  25. 2018Query Attack via Opposite-Direction Feature:Towards Robust Image Retrievalcited by 7
  26. 2019Adversarial Metric Attack and Defense for Person Re-identificationcited by 7
  27. 2019Unsupervised Adversarial Attacks on Deep Feature-based Retrieval with GANcited by 4

Built on by

Cited by year

Citing papers per year: 2021: 2; 2022: 4; 2023: 2; 2024: 0; 2025: 1.

9 papers.

  1. 2021Person Re-identification Method Based on Color Attack and Joint Defencecited by 56
  2. 2022Order-Disorder: Imitation Adversarial Attacks for Black-box Neural Ranking Modelscited by 37
  3. 2022Enhancing Adversarial Robustness for Deep Metric Learningcited by 10
  4. 2021Adversarial Attack and Defense in Deep Rankingcited by 8
  5. 2023Collapse-Aware Triplet Decoupling for Adversarially Robust Image Retrievalcited by 2
  6. 2022Provable Robust Saliency-based Explanationscited by 1
  7. 2025Adversarial Video Promotion Against Text-to-Video Retrievalcited by 1
  8. 2022Advancing Deep Metric Learning Through Multiple Batch Norms And Multi-Targeted Adversarial Examplescited by 0
  9. 2023Robust Ranking Explanationscited by 0